Given that a firewall has to hook the network API, it's not surprising that a driver would have to be installed. The hooking can be dynamic, however, although I have yet to see a firewall implement that functionality as static boot-time hooking is usually easier.